Security and Customer Control

Your organization's data

Access to staffing records is checked against the signed-in user's organization. Tenant-scoped access checks and database relationships are designed to keep each organization's records separate.

Permissions with purpose

Roles control who can view, recommend, approve and manage sensitive settings. Customer administration does not grant access to another organization's support requests.

Controlled data connections

Integration access is limited to permitted data. Credentials can be rotated or revoked, and stored connector credentials are encrypted.

People approve commitments

Recommendations support human judgment. Manual Overrides preserve a reason, and the staffing workflow keeps review and commitment distinct.

History you can follow

Review Recommendations, Overrides, Approvals, Allocation changes and changes to external workload in their operational context.

Only the information needed

Choose authorized staffing data sources and shared fields. Public inquiry forms are not a place for employee records, customer data or credentials.

AI with a defined role

Insight stays within the purpose of the question.

Insighter reads authorized IntraPod records to help explain staffing conditions, with supporting links and visible limitations. It cannot change staffing.

The Support Assistant answers questions about using IntraPod from approved help content. It serves a different purpose from Insighter.

Optional document analysis sends an uploaded PDF or Word document to OpenAI to prepare a Project draft. Review the extracted details and supporting excerpts before confirming what to save. AI output can be incomplete or incorrect; it does not authorize staffing changes.

See the Privacy Policy for information about data handling and service providers.

Access and data handling

Understand what is configured for your organization.

Identity and MFA

Owners can start enterprise SSO setup through WorkOS. SSO MFA follows your identity provider's policy. For non-SSO sign-in, an MFA request must be applied and verified; submitting a request does not enable enforcement.

Uploads and exports

Imports use permission checks, file limits and validation, with review before data is saved. These checks are not malware scanning. Authorized organization exports include selected business and history records, rather than a complete security-log archive.

Retention and deletion

Owners can request organization closure and data deletion through Support. A request does not immediately erase records or backups. Retention, provider handling and deletion scope need to be agreed for your use.

Current assurance status

Evidence before promises.

As of October 5, 2026, IntraPod is being evaluated in staging. Internal automated checks and a limited database restore exercise have been completed. They are not an independent penetration test, a full production recovery exercise or a SOC 2 examination.

Production acceptance, operational alerting, internal transport-encryption hardening and documented security operating procedures remain in progress. We do not claim that all internal service traffic is encrypted, that required MFA is enabled for every organization, or that a production availability or recovery SLA has been established.

IntraPod has no SOC 2 report or ISO 27001 certification. We can share the applicable evidence and discuss gaps during your security review, without treating provider capabilities as proof that a control is enabled.

Discuss your security requirements with us.

We can walk through access controls, data sources and operational requirements as part of your evaluation. Any service levels, data-residency requirements and contractual commitments must be agreed separately.